Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/10/2024, 01:17
Static task
static1
Behavioral task
behavioral1
Sample
c1ac0a5f1f9f93f9f35cec761589df1489f5852ae820d9d7e1e88496df686454.exe
Resource
win7-20240903-en
General
-
Target
c1ac0a5f1f9f93f9f35cec761589df1489f5852ae820d9d7e1e88496df686454.exe
-
Size
70KB
-
MD5
fb7019ca69db86832cecfbc7e1207e11
-
SHA1
33d00efaf8038ab338bc11aa0ac3779bbd53e64b
-
SHA256
c1ac0a5f1f9f93f9f35cec761589df1489f5852ae820d9d7e1e88496df686454
-
SHA512
5bc085a1e77a4ce9dd79f42f88acf2dcfd854be9c6bc7f0484f245f2d43ead39da011feaa58307f68a30a4946f5f93e06bb539852345ed663498205bc8faaead
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6Mu/ePS3AK:ymb3NkkiQ3mdBjFI46TQK
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/1916-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1916-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2312-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2324-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4888-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/220-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/220-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4172-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4208-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1436-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1436-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2800-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2384-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2952-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1480-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3436-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2260-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1388-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2992-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/784-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4160-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3416-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3548-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/812-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2312 nnhnnh.exe 2324 1dppj.exe 4888 flxxlrx.exe 220 lfxrrrx.exe 4172 hbhhhn.exe 4208 jppdv.exe 1436 lllllxr.exe 2800 tbnhbb.exe 2320 3ddvd.exe 3432 vvpdj.exe 2384 fxxrllf.exe 2952 7bbtnh.exe 1480 jvpjj.exe 3436 pjpjp.exe 4392 5ffxlfx.exe 2260 btnhhb.exe 3508 htttht.exe 1388 dvvdj.exe 2992 jjjdd.exe 3452 xxrxfrf.exe 784 hbhbbt.exe 4160 tbtntn.exe 5076 jpjjd.exe 4488 3lrlffx.exe 3416 tttnht.exe 264 ttnbbt.exe 3548 pvvjp.exe 2864 xrxlxlf.exe 812 1bbthh.exe 3640 bbthth.exe 2196 7vpjp.exe 3116 dpjdp.exe 964 3ffffff.exe 4784 thbtth.exe 4528 3nhthh.exe 4068 jddvj.exe 4008 jdpjp.exe 1824 frrlrlf.exe 2700 rlxrrfr.exe 1936 fflfxrf.exe 3768 btnhhn.exe 4320 pjjdd.exe 4620 jvvjd.exe 3312 fllxrfr.exe 3024 1rlrfxx.exe 432 hnbnbt.exe 4896 bhhhbb.exe 4712 pjvjv.exe 5080 xffrlfx.exe 2668 lllxrlx.exe 4644 nnbtnn.exe 2556 btnbtn.exe 2584 3ddpv.exe 3644 pdpdp.exe 32 9fxrfxr.exe 4248 5xxrffr.exe 4204 bnhttn.exe 1164 jjjdp.exe 4928 7vvpd.exe 3148 xlflxfx.exe 4092 bbnbbb.exe 3928 nhhnbt.exe 5064 xlfrlfr.exe 4824 fllfrlf.exe -
resource yara_rule behavioral2/memory/1916-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1916-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2312-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2312-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2312-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2312-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2324-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4888-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/220-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/220-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/220-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4172-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4172-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4208-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1436-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1436-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1436-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1436-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2800-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2320-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2320-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2384-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2952-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1480-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3436-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2260-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1388-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2992-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/784-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4160-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3416-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3548-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/812-200-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbthth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lrfrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfflrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hhbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxffxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1916 wrote to memory of 2312 1916 c1ac0a5f1f9f93f9f35cec761589df1489f5852ae820d9d7e1e88496df686454.exe 85 PID 1916 wrote to memory of 2312 1916 c1ac0a5f1f9f93f9f35cec761589df1489f5852ae820d9d7e1e88496df686454.exe 85 PID 1916 wrote to memory of 2312 1916 c1ac0a5f1f9f93f9f35cec761589df1489f5852ae820d9d7e1e88496df686454.exe 85 PID 2312 wrote to memory of 2324 2312 nnhnnh.exe 86 PID 2312 wrote to memory of 2324 2312 nnhnnh.exe 86 PID 2312 wrote to memory of 2324 2312 nnhnnh.exe 86 PID 2324 wrote to memory of 4888 2324 1dppj.exe 87 PID 2324 wrote to memory of 4888 2324 1dppj.exe 87 PID 2324 wrote to memory of 4888 2324 1dppj.exe 87 PID 4888 wrote to memory of 220 4888 flxxlrx.exe 88 PID 4888 wrote to memory of 220 4888 flxxlrx.exe 88 PID 4888 wrote to memory of 220 4888 flxxlrx.exe 88 PID 220 wrote to memory of 4172 220 lfxrrrx.exe 90 PID 220 wrote to memory of 4172 220 lfxrrrx.exe 90 PID 220 wrote to memory of 4172 220 lfxrrrx.exe 90 PID 4172 wrote to memory of 4208 4172 hbhhhn.exe 91 PID 4172 wrote to memory of 4208 4172 hbhhhn.exe 91 PID 4172 wrote to memory of 4208 4172 hbhhhn.exe 91 PID 4208 wrote to memory of 1436 4208 jppdv.exe 92 PID 4208 wrote to memory of 1436 4208 jppdv.exe 92 PID 4208 wrote to memory of 1436 4208 jppdv.exe 92 PID 1436 wrote to memory of 2800 1436 lllllxr.exe 93 PID 1436 wrote to memory of 2800 1436 lllllxr.exe 93 PID 1436 wrote to memory of 2800 1436 lllllxr.exe 93 PID 2800 wrote to memory of 2320 2800 tbnhbb.exe 94 PID 2800 wrote to memory of 2320 2800 tbnhbb.exe 94 PID 2800 wrote to memory of 2320 2800 tbnhbb.exe 94 PID 2320 wrote to memory of 3432 2320 3ddvd.exe 95 PID 2320 wrote to memory of 3432 2320 3ddvd.exe 95 PID 2320 wrote to memory of 3432 2320 3ddvd.exe 95 PID 3432 wrote to memory of 2384 3432 vvpdj.exe 96 PID 3432 wrote to memory of 2384 3432 vvpdj.exe 96 PID 3432 wrote to memory of 2384 3432 vvpdj.exe 96 PID 2384 wrote to memory of 2952 2384 fxxrllf.exe 97 PID 2384 wrote to memory of 2952 2384 fxxrllf.exe 97 PID 2384 wrote to memory of 2952 2384 fxxrllf.exe 97 PID 2952 wrote to memory of 1480 2952 7bbtnh.exe 98 PID 2952 wrote to memory of 1480 2952 7bbtnh.exe 98 PID 2952 wrote to memory of 1480 2952 7bbtnh.exe 98 PID 1480 wrote to memory of 3436 1480 jvpjj.exe 99 PID 1480 wrote to memory of 3436 1480 jvpjj.exe 99 PID 1480 wrote to memory of 3436 1480 jvpjj.exe 99 PID 3436 wrote to memory of 4392 3436 pjpjp.exe 100 PID 3436 wrote to memory of 4392 3436 pjpjp.exe 100 PID 3436 wrote to memory of 4392 3436 pjpjp.exe 100 PID 4392 wrote to memory of 2260 4392 5ffxlfx.exe 101 PID 4392 wrote to memory of 2260 4392 5ffxlfx.exe 101 PID 4392 wrote to memory of 2260 4392 5ffxlfx.exe 101 PID 2260 wrote to memory of 3508 2260 btnhhb.exe 102 PID 2260 wrote to memory of 3508 2260 btnhhb.exe 102 PID 2260 wrote to memory of 3508 2260 btnhhb.exe 102 PID 3508 wrote to memory of 1388 3508 htttht.exe 103 PID 3508 wrote to memory of 1388 3508 htttht.exe 103 PID 3508 wrote to memory of 1388 3508 htttht.exe 103 PID 1388 wrote to memory of 2992 1388 dvvdj.exe 104 PID 1388 wrote to memory of 2992 1388 dvvdj.exe 104 PID 1388 wrote to memory of 2992 1388 dvvdj.exe 104 PID 2992 wrote to memory of 3452 2992 jjjdd.exe 105 PID 2992 wrote to memory of 3452 2992 jjjdd.exe 105 PID 2992 wrote to memory of 3452 2992 jjjdd.exe 105 PID 3452 wrote to memory of 784 3452 xxrxfrf.exe 106 PID 3452 wrote to memory of 784 3452 xxrxfrf.exe 106 PID 3452 wrote to memory of 784 3452 xxrxfrf.exe 106 PID 784 wrote to memory of 4160 784 hbhbbt.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1ac0a5f1f9f93f9f35cec761589df1489f5852ae820d9d7e1e88496df686454.exe"C:\Users\Admin\AppData\Local\Temp\c1ac0a5f1f9f93f9f35cec761589df1489f5852ae820d9d7e1e88496df686454.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\nnhnnh.exec:\nnhnnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\1dppj.exec:\1dppj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\flxxlrx.exec:\flxxlrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\lfxrrrx.exec:\lfxrrrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\hbhhhn.exec:\hbhhhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
\??\c:\jppdv.exec:\jppdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
\??\c:\lllllxr.exec:\lllllxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\tbnhbb.exec:\tbnhbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\3ddvd.exec:\3ddvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\vvpdj.exec:\vvpdj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
\??\c:\fxxrllf.exec:\fxxrllf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\7bbtnh.exec:\7bbtnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\jvpjj.exec:\jvpjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\pjpjp.exec:\pjpjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
\??\c:\5ffxlfx.exec:\5ffxlfx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
\??\c:\btnhhb.exec:\btnhhb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\htttht.exec:\htttht.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\dvvdj.exec:\dvvdj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\jjjdd.exec:\jjjdd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\xxrxfrf.exec:\xxrxfrf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
\??\c:\hbhbbt.exec:\hbhbbt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
\??\c:\tbtntn.exec:\tbtntn.exe23⤵
- Executes dropped EXE
PID:4160 -
\??\c:\jpjjd.exec:\jpjjd.exe24⤵
- Executes dropped EXE
PID:5076 -
\??\c:\3lrlffx.exec:\3lrlffx.exe25⤵
- Executes dropped EXE
PID:4488 -
\??\c:\tttnht.exec:\tttnht.exe26⤵
- Executes dropped EXE
PID:3416 -
\??\c:\ttnbbt.exec:\ttnbbt.exe27⤵
- Executes dropped EXE
PID:264 -
\??\c:\pvvjp.exec:\pvvjp.exe28⤵
- Executes dropped EXE
PID:3548 -
\??\c:\xrxlxlf.exec:\xrxlxlf.exe29⤵
- Executes dropped EXE
PID:2864 -
\??\c:\1bbthh.exec:\1bbthh.exe30⤵
- Executes dropped EXE
PID:812 -
\??\c:\bbthth.exec:\bbthth.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3640 -
\??\c:\7vpjp.exec:\7vpjp.exe32⤵
- Executes dropped EXE
PID:2196 -
\??\c:\dpjdp.exec:\dpjdp.exe33⤵
- Executes dropped EXE
PID:3116 -
\??\c:\3ffffff.exec:\3ffffff.exe34⤵
- Executes dropped EXE
PID:964 -
\??\c:\thbtth.exec:\thbtth.exe35⤵
- Executes dropped EXE
PID:4784 -
\??\c:\3nhthh.exec:\3nhthh.exe36⤵
- Executes dropped EXE
PID:4528 -
\??\c:\jddvj.exec:\jddvj.exe37⤵
- Executes dropped EXE
PID:4068 -
\??\c:\jdpjp.exec:\jdpjp.exe38⤵
- Executes dropped EXE
PID:4008 -
\??\c:\frrlrlf.exec:\frrlrlf.exe39⤵
- Executes dropped EXE
PID:1824 -
\??\c:\rlxrrfr.exec:\rlxrrfr.exe40⤵
- Executes dropped EXE
PID:2700 -
\??\c:\fflfxrf.exec:\fflfxrf.exe41⤵
- Executes dropped EXE
PID:1936 -
\??\c:\btnhhn.exec:\btnhhn.exe42⤵
- Executes dropped EXE
PID:3768 -
\??\c:\pjjdd.exec:\pjjdd.exe43⤵
- Executes dropped EXE
PID:4320 -
\??\c:\jvvjd.exec:\jvvjd.exe44⤵
- Executes dropped EXE
PID:4620 -
\??\c:\fllxrfr.exec:\fllxrfr.exe45⤵
- Executes dropped EXE
PID:3312 -
\??\c:\1rlrfxx.exec:\1rlrfxx.exe46⤵
- Executes dropped EXE
PID:3024 -
\??\c:\hnbnbt.exec:\hnbnbt.exe47⤵
- Executes dropped EXE
PID:432 -
\??\c:\bhhhbb.exec:\bhhhbb.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4896 -
\??\c:\pjvjv.exec:\pjvjv.exe49⤵
- Executes dropped EXE
PID:4712 -
\??\c:\xffrlfx.exec:\xffrlfx.exe50⤵
- Executes dropped EXE
PID:5080 -
\??\c:\lllxrlx.exec:\lllxrlx.exe51⤵
- Executes dropped EXE
PID:2668 -
\??\c:\nnbtnn.exec:\nnbtnn.exe52⤵
- Executes dropped EXE
PID:4644 -
\??\c:\btnbtn.exec:\btnbtn.exe53⤵
- Executes dropped EXE
PID:2556 -
\??\c:\3ddpv.exec:\3ddpv.exe54⤵
- Executes dropped EXE
PID:2584 -
\??\c:\pdpdp.exec:\pdpdp.exe55⤵
- Executes dropped EXE
PID:3644 -
\??\c:\9fxrfxr.exec:\9fxrfxr.exe56⤵
- Executes dropped EXE
PID:32 -
\??\c:\5xxrffr.exec:\5xxrffr.exe57⤵
- Executes dropped EXE
PID:4248 -
\??\c:\bnhttn.exec:\bnhttn.exe58⤵
- Executes dropped EXE
PID:4204 -
\??\c:\jjjdp.exec:\jjjdp.exe59⤵
- Executes dropped EXE
PID:1164 -
\??\c:\7vvpd.exec:\7vvpd.exe60⤵
- Executes dropped EXE
PID:4928 -
\??\c:\xlflxfx.exec:\xlflxfx.exe61⤵
- Executes dropped EXE
PID:3148 -
\??\c:\bbnbbb.exec:\bbnbbb.exe62⤵
- Executes dropped EXE
PID:4092 -
\??\c:\nhhnbt.exec:\nhhnbt.exe63⤵
- Executes dropped EXE
PID:3928 -
\??\c:\xlfrlfr.exec:\xlfrlfr.exe64⤵
- Executes dropped EXE
PID:5064 -
\??\c:\fllfrlf.exec:\fllfrlf.exe65⤵
- Executes dropped EXE
PID:4824 -
\??\c:\tthhtn.exec:\tthhtn.exe66⤵PID:3452
-
\??\c:\nhhnnt.exec:\nhhnnt.exe67⤵PID:3552
-
\??\c:\3vpdp.exec:\3vpdp.exe68⤵PID:4380
-
\??\c:\flfrfxl.exec:\flfrfxl.exe69⤵PID:1952
-
\??\c:\1rrlxrl.exec:\1rrlxrl.exe70⤵PID:1000
-
\??\c:\flrxfrr.exec:\flrxfrr.exe71⤵PID:2460
-
\??\c:\tbtbht.exec:\tbtbht.exe72⤵PID:3652
-
\??\c:\jvvpd.exec:\jvvpd.exe73⤵
- System Location Discovery: System Language Discovery
PID:1644 -
\??\c:\pppjv.exec:\pppjv.exe74⤵PID:704
-
\??\c:\rllxfxf.exec:\rllxfxf.exe75⤵PID:2864
-
\??\c:\bhntth.exec:\bhntth.exe76⤵PID:1048
-
\??\c:\9hhttn.exec:\9hhttn.exe77⤵PID:3524
-
\??\c:\vvvjp.exec:\vvvjp.exe78⤵PID:4764
-
\??\c:\lxrfxll.exec:\lxrfxll.exe79⤵PID:4660
-
\??\c:\flxrrfr.exec:\flxrrfr.exe80⤵PID:3116
-
\??\c:\7nbtbt.exec:\7nbtbt.exe81⤵PID:964
-
\??\c:\vpjdd.exec:\vpjdd.exe82⤵PID:4560
-
\??\c:\5jvvj.exec:\5jvvj.exe83⤵PID:3420
-
\??\c:\lxrlrxr.exec:\lxrlrxr.exe84⤵PID:1612
-
\??\c:\7rrfrlx.exec:\7rrfrlx.exe85⤵PID:2816
-
\??\c:\nttnbt.exec:\nttnbt.exe86⤵PID:2032
-
\??\c:\hhnbth.exec:\hhnbth.exe87⤵PID:2700
-
\??\c:\jvpdp.exec:\jvpdp.exe88⤵PID:1936
-
\??\c:\djdpd.exec:\djdpd.exe89⤵PID:3768
-
\??\c:\3lrlxxr.exec:\3lrlxxr.exe90⤵PID:4208
-
\??\c:\nhbnbt.exec:\nhbnbt.exe91⤵PID:4200
-
\??\c:\ththhb.exec:\ththhb.exe92⤵PID:4672
-
\??\c:\dvpjp.exec:\dvpjp.exe93⤵PID:2800
-
\??\c:\vdvvp.exec:\vdvvp.exe94⤵PID:2780
-
\??\c:\rxxrxrr.exec:\rxxrxrr.exe95⤵PID:3984
-
\??\c:\fxxrrlf.exec:\fxxrrlf.exe96⤵PID:2524
-
\??\c:\nbthth.exec:\nbthth.exe97⤵PID:4880
-
\??\c:\nttntn.exec:\nttntn.exe98⤵PID:3172
-
\??\c:\pjjvj.exec:\pjjvj.exe99⤵PID:2952
-
\??\c:\jjddv.exec:\jjddv.exe100⤵PID:2664
-
\??\c:\ffrfxrf.exec:\ffrfxrf.exe101⤵PID:4252
-
\??\c:\llxxxff.exec:\llxxxff.exe102⤵PID:2636
-
\??\c:\tttnhb.exec:\tttnhb.exe103⤵PID:4108
-
\??\c:\ppvpd.exec:\ppvpd.exe104⤵PID:1544
-
\??\c:\rfxlfxr.exec:\rfxlfxr.exe105⤵PID:2656
-
\??\c:\1lrllfl.exec:\1lrllfl.exe106⤵PID:2548
-
\??\c:\bhthnb.exec:\bhthnb.exe107⤵PID:4584
-
\??\c:\jdvvv.exec:\jdvvv.exe108⤵PID:936
-
\??\c:\1ddvd.exec:\1ddvd.exe109⤵PID:1836
-
\??\c:\rxxrrlf.exec:\rxxrrlf.exe110⤵PID:1784
-
\??\c:\ttbbhb.exec:\ttbbhb.exe111⤵PID:1648
-
\??\c:\hbnhtb.exec:\hbnhtb.exe112⤵PID:5068
-
\??\c:\dvppj.exec:\dvppj.exe113⤵PID:2400
-
\??\c:\vpjdd.exec:\vpjdd.exe114⤵PID:2928
-
\??\c:\xrrrllx.exec:\xrrrllx.exe115⤵PID:3816
-
\??\c:\fllrrll.exec:\fllrrll.exe116⤵PID:3600
-
\??\c:\1ttnhh.exec:\1ttnhh.exe117⤵PID:4488
-
\??\c:\nhbnnh.exec:\nhbnnh.exe118⤵PID:3744
-
\??\c:\jjppd.exec:\jjppd.exe119⤵PID:264
-
\??\c:\dpvvj.exec:\dpvvj.exe120⤵PID:708
-
\??\c:\rfflrfl.exec:\rfflrfl.exe121⤵
- System Location Discovery: System Language Discovery
PID:4456 -
\??\c:\bhhnhh.exec:\bhhnhh.exe122⤵PID:3376
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-